A privacy protection clustering method and system

Abstract

The present invention discloses a privacy-preserving clustering method and system. A querying party obtains data to be queried, performs homomorphic encryption on the data to be queried to obtain the encrypted data to be queried, obtains a training set held by a first central server agent, initializes an estimated vector of the data to be queried, and sends it to the first central server; each data holder learns the encrypted data to be queried based on a weak model trained with local data, obtains a weak learning result corresponding to the data to be queried under ciphertext, and sends it to the first central server; the first central server initializes a weight matrix, and based on the weight matrix and the weak learning result corresponding to the data to be queried under ciphertext, jointly interacts with a second central server through a dual-center agent to obtain an initialized aggregation result, and iteratively updates the aggregation result in combination with the estimated vector of each data to be queried, and sends the updated aggregation result to the querying party; after the querying party decrypts the aggregation result, it calculates and obtains a clustering query result, and the data to be queried by the customer will not be leaked.

Description

Technical Field

[0001] The present invention relates to the field of privacy protection technology, and in particular to a privacy protection clustering method and system. Background Art

[0002] The statements in this section merely mention background art related to the present invention and do not necessarily constitute prior art.

[0003] An emerging trend is to embed machine learning models at the edge to improve their capabilities in daily applications. However, these models often perform poorly due to hardware limitations and limited training data. Improving the overall inference performance of these models in edge devices with limited and biased training data becomes an important issue that needs to be addressed.

[0004] In the traditional system model based on aggregating weak results from multiple parties to obtain ideal results, the provider of the data to be queried often needs to send the data to be queried in plain text to the intermediate proxy server. The intermediate proxy server then sends the data in plain text to each edge organization, which can train a weaker model based on local data. This process has privacy leakage issues. Summary of the invention

[0005] In order to address the deficiencies of the prior art, the present invention provides a privacy-preserving clustering method and system, which can obtain ideal clustering query results without leaking the customer's data to be queried, thereby ensuring the privacy and security of the customer's data.

[0006] In a first aspect, the present invention provides a privacy-preserving clustering method;

[0007] A privacy-preserving clustering method comprises the following steps:

[0008] The querying party obtains the data to be queried, performs homomorphic encryption on the data to be queried, obtains the encrypted data to be queried, obtains the training set held by the first central server agent, initializes the estimated vector of the data to be queried, and sends it to the first central server; each data holder learns the encrypted data to be queried based on the weak model trained by the local data, obtains the weak learning result corresponding to the data to be queried under the ciphertext, and sends it to the first central server;

[0009] The first central server initializes the weight matrix, and based on the weight matrix and the weak learning result corresponding to the data to be queried under the ciphertext, cooperates with the second central server through dual-center proxy interaction to obtain an initialized aggregation result, and iteratively updates the aggregation result in combination with the estimated vector of the data to be queried, and sends the updated aggregation result to the querying party;

[0010] After the querying party decrypts the aggregation result, it calculates and obtains the clustering query result.

[0011] Furthermore, the weight matrix is ​​calculated as follows:

[0012] The first central server removes the labels of the training set held by the first central server agent and sends it to all data holders;

[0013] Each data holder obtains a weak learning result corresponding to the training set held by the first central server agent based on the training set held by the first central server agent after de-labeling, and sends it to the first central server;

[0014] The first central server calculates the weight matrix based on the weak learning results corresponding to the training set held by the first central server agent.

[0015] Furthermore, the specific method of initializing the estimation vector of the data to be queried is:

[0016] Based on the training set held by the first central server agent, calculate the expected value of all data under each label;

[0017] The Euclidean distance between the query data and the expected value of all data under each label is calculated, and after normalization, the estimated vector of the initialized query data is obtained.

[0018] Furthermore, the specific method for iteratively updating the aggregation result is:

[0019] In a certain round, the first central server calculates the estimated vector of each data to be queried in this round based on the aggregation result of the previous round and the estimated vector of the data to be queried, and calculates the weight matrix of this round in combination with the weight matrix of the previous round;

[0020] The first central server and the second central server obtain the aggregation result of this round through dual-center proxy interaction based on the weak learning result corresponding to the to-be-queried data under the ciphertext, the aggregation result of the previous round and the weight matrix of this round.

[0021] Furthermore, the specific steps of the dual-center agent interaction are:

[0022] The first central server multiplies the weak learning result corresponding to the to-be-queried data under a certain ciphertext by the weight matrix to obtain a first product ciphertext, and randomly generates a random value, obtains a reference value and a second product ciphertext based on the random value and the first product ciphertext, and sends them to the second central server;

[0023] The second central server obtains the first index result and the second index result based on the second product ciphertext and the reference value, encrypts the first index result and the second index result respectively, and sends them to the first central server;

[0024] The first central server obtains a ciphertext of a third index result based on the encrypted first index result and the second index result, and calculates an initialization aggregation result based on the ciphertext of the third index result.

[0025] Furthermore, the second product ciphertext is the product of the ciphertext of the random number k and the first product ciphertext; and the reference value is the random value power of e.

[0026] Furthermore, the reference value is a random value raised to the power of e.

[0027] Furthermore, the first exponential result calculation method is: using a private key to decrypt the second product ciphertext to obtain a decrypted value, and calculating the decrypted value power of e to obtain a first exponential result.

[0028] Furthermore, the second index result is calculated by dividing the first index result by the reference value, and then multiplying the result by the difference between 1 and the reference value to obtain the second index result.

[0029] In a second aspect, the present invention also provides a privacy protection clustering system;

[0030] A privacy protection clustering system includes a querying party, a first central server, a second central server, and a plurality of data holders;

[0031] The querying party is used to obtain the data to be queried, perform homomorphic encryption on the data to be queried, obtain the encrypted data to be queried, and obtain the training set held by the first central server agent, initialize the estimated vector of the data to be queried, and send it to the first central server; the data holder is used to learn the encrypted data to be queried based on the weak model trained by the local data, obtain the weak learning result corresponding to the data to be queried under the ciphertext, and send it to the first central server;

[0032] The first central server is used to initialize the weight matrix, and based on the weight matrix and the weak learning result corresponding to the data to be queried under the ciphertext, the second central server interacts with the second central server through a dual-center proxy to obtain an initialized aggregation result, and iteratively updates the aggregation result in combination with the estimated vector of the data to be queried, and sends the updated aggregation result to the query party;

[0033] The query side is also used to decrypt the aggregation results and calculate the clustering query results.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] A privacy-preserving clustering method of the present invention combines a weak-to-strong result aggregation method with cryptographic privacy protection technology to achieve clustering query of privacy-preserving federated learning. During the entire clustering application process, application participants and edge institutions will not leak data privacy. It is possible to obtain ideal clustering query results without the need to jointly train an ideal machine learning model, and will not leak customer data to be queried, thereby ensuring the privacy and security of customer data. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings in the specification, which constitute a part of the present application, are used to provide further understanding of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0037] Figure 1 This is a flowchart of the learning process of ciphertext through a neural network in homomorphic encryption;

[0038] Figure 2 This is a flowchart of the softmax function process;

[0039] Figure 3 This is a flow chart of initializing the polymerization method of Embodiment 1;

[0040] Figure 4 This is a flow chart of the dual-server interaction mechanism of Embodiment 1;

[0041] Figure 5 This is a flow chart of the privacy protection clustering method according to Embodiment 1;

[0042] Figure 6 A training flow chart of weak learning results corresponding to the training set held by the first central server agent in Example 1;

[0043] Figure 7 This is a training flow chart of the weak learning results corresponding to the query data in Example 1. DETAILED DESCRIPTION

[0044] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0045] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0046] Terminology explanation section:

[0047] Homomorphic encryption: A special type of encryption function based on the homomorphic principle, which focuses on data processing security and allows encrypted data to be processed directly without knowing any information about the decryption function. Often when the encryption algorithm must satisfy a certain homomorphic encryption, the encryption end can directly operate on the ciphertext after sending it to the server. Formal expression:

[0048] x1,x2,x3,...,x n →[x1],[x2],[x3],...,[x n ]

[0049] f([x1],[x2],[x3],...,[x n ])=[f(x1,x2,x3,...,x n )]

[0050] Among them, x i , i∈[1,n] is the plaintext, [x i ], i∈[1,n] is the encrypted ciphertext, and f(·) represents the mathematical operation on the internal parameters. The process flow of the ciphertext through the neural network learning is as follows Figure 1 shown.

[0051] Softmax function: Its function is normalization. It is a generalization of the binary classification function sigmoid in multi-classification. Its purpose is to present the results of multi-classification in the form of probability. Softmax is used in the multi-classification process. It maps the outputs of multiple neurons to the interval (0,1) and regards them as probabilities, and then performs multi-classification. The basic process is as follows Figure 2 As shown. According to the input vector X=(x1,x2,...,x n ), and get the prediction result vector Y=(y1,y2,...,y n )The direct probability relationship satisfies: Decompose the prediction function P(y|x) into two steps:

[0052] ①Multiply the yth row of the neural network model parameter matrix W by the input vector x:

[0053]

[0054] Calculate all f c , where c represents the number of rows of W, c=1,...,C, and d represents the dimensions of W and x.

[0055] ②Use the softmax function to get the normalized probability:

[0056]

[0057] Spearman rank correlation coefficient: It is used to estimate the correlation between two variables x and y, where the correlation between variables can be described by a monotonic function. This coefficient is usually considered to be the Pearson linear correlation coefficient between the arranged variables. Assume that the original data x i and i Already sorted, record x′ i and y′ i For the original x i and i At the location of the data after arrangement, x′ i ,y′ i Becomes the variable x i ,y i rank, then d i = x′ i -y′ i becomes the rank difference. If there is no identical rank, then ρ s It can be calculated by the following formula:

[0058]

[0059] Among them, ρ s represents the Spearman correlation coefficient, n represents the number of data points, d i Represents a data point (x i ,y i ) Difference: If the same rank exists, then it is necessary to calculate the linear correlation coefficient of the Person between the ranks:

[0060]

[0061] Among them, ρ s represents the Spearman correlation coefficient, and Represents the mean of data with the same rank.

[0062] Embodiment 1

[0063] This embodiment provides a privacy-preserving clustering method. In order to enable the intermediate proxy server to aggregate the weak learning results provided by each data holder (edge ​​institution, medical institution) into a strong learning result, a feasible method is needed to achieve aggregation. Specifically, the aggregation method needs to go through repeated iterative calculations of some functions to achieve the optimization of data from inferior to excellent. Specifically, assuming that Pred is the ideal aggregation result of the final medical image classification vector, the iterative operation of Pred is simply defined as:

[0064]

[0065] Among them, Prob represents the weak learning results initially obtained from each data holder, N represents the number of marginal institutions, and W is a vector of the response model capabilities designed to strengthen the classification advantages of a certain data holder's weak model and weaken the model's deficiencies. This vector is defined as

[0066]

[0067] Among them, Z τ is a regularization parameter. After regularization Y is the cluster label set, N is the number of edge organizations, i∈{1,…,N}. Cor is the spearman rank correlation coefficient, which calculates the strong correlation between W and Dist. Dist is the prediction of the query medical image clustering learning result. Its implementation depends on two hyperparameters α and ρ. α∈(0,1) is the threshold for determining whether the prediction is reliable, and ρ is a probability decay parameter used to replace the estimated probability distribution with a probability weighted as 1. In the τth round of iterative calculation, if Dist τ-1 If the maximum component in the vector is less than α, then Dist τ Assign Dist with probability ρ τ-1 , with a probability of 1- assigned to Pred τ-1 ; Otherwise Dist τ ←Dist τ-1 It is not difficult to find that W, Dist and Pred need to be initialized during the iterative aggregation process, and their initialization is expressed as:

[0068]

[0069]

[0070]

[0071] Among them, Pr represents the internal equation argmaxM i (x) = probability of establishment.

[0072] Based on this iterative aggregation method, the clustering vector results of the weak models of all data holders can be optimized and aggregated from inferior to superior, so as to obtain medical image clustering query results with high accuracy and high credibility. However, in the implementation, since the initialization of the aggregation process requires the use of real data of the image to be queried, how to design the aggregation method required for iteration without leaking this data is a core problem that needs to be solved urgently. In the case that the intermediate proxy server does not have image data, the central server interacts with the query party to complete the relevant operations and finally realize the above-mentioned aggregation operation. The specific aggregation process is as follows: Figure 3 shown.

[0073] Since the first central server Agent (A) needs to perform exponential operations on the dense state prob when calculating Pred, which is impossible, a dual-server interaction mechanism is introduced to achieve this, such as Figure 4 shown.

[0074] The present invention introduces a semi-trusted central agent and uses a weak-to-strong result aggregation method, such as Figure 5 As shown, there are three layers of roles in the method of the present invention: data holders (DOs), holders of training data, generators and owners of weak models, and crowdsourcing objects; third-party agents (Agents), trusted third-party agents, intermediaries between DOs and Users, and agents for aggregating weak result agents learned by weak models (that is, two central servers, the first central server Agent (A) and the second central server Agent (B)); query parties (Users), beneficiaries of the application, provide data to be queried.

[0075] User first homomorphically encrypts the data to be queried, and then sends the ciphertext to Agent (A). Agent (A) broadcasts the ciphertext to DOs. DOs learn the weak result under the ciphertext through the local weak learning model (weak model). Each DOs sends the weak learning result (weak result) of the ciphertext learned based on the local weak model to Agent (A). Agent (A) and Agent (B) interact and calculate, and obtain the ciphertext of the ideal result (idealresult) through the τ-round aggregation algorithm. Agent (A) finally sends the ciphertext of the ideal result to the User. Finally, the User decrypts and then uses the argmax() function to obtain the clustering result of the query. Agent (A) can prevent external users from directly accessing the weak models trained by DOs: M1, M2, …, M N It is responsible for collecting all weak results from distributed DOs and computing the final prediction of clustering queries using an aggregation algorithm.

[0076] This embodiment provides a privacy protection clustering method, such as Figure 5 As shown, the specific steps include:

[0077] Step 1: Initialization phase:

[0078] Step 101, Agent (A) takes D A (D A It is a data set with labels held by Agent (A). It should be noted that the holder of real and effective data is the edge organization. In this paper, the data set held by the edge organization is called D i However, Agent (A) also has a small amount of labeled data locally. This data set is defined as the training set D held by the first central server agent. A , these data are held by Agent (A) itself. These data are independent of the edge organization and have nothing to do with the data of the edge organization, and will not leak the data of the edge organization itself. A The existence of is only to provide some necessary data conditions for realizing the function of the entire weak-to-strong model) Remove the label (Label) to get D A ′, D A ′ is sent to Dos, and the training set D held by the first central server agent obtained by the weak learning model A Corresponding weak learning results Process such as Figure 6 As shown:

[0079]

[0080]

[0081] Among them, L i ∈{1,…,L}, L is the classifiable category, i∈{1,…,n A},n A =|D A |. The training set D held by the first central server agent obtained by the i-th data holder through weak learning model learning A The corresponding weak learning results are:

[0082]

[0083] Where i∈[1,N], N is the number of DOs, p jk It represents the probability that the jth query data is clustered as the kth label after the neural network is learned, j∈{1,…,n A}, k∈{1,…,L}.

[0084] Step 102, Agent (A) initializes the weight matrix:

[0085] DOs will Prob A (Prob A is plain text, because Agent (A) holds data D locally A It does not involve privacy issues, so it is natural for D A The learning results of (without considering privacy issues) are sent to Agent (A), so:

[0086]

[0087] Agent (A) initializes the weight matrix W based on the above known (0) Among them, the weight of the i-th data holder to the l-th label is:

[0088] Step 103: User calculates and initializes the distance matrix Dist (0) :

[0089]

[0090] in, Represents the initialization of the estimated vector (Dist) of the jth cluster data to be queried, j∈{1,…,n Q}, Indicates the jth cluster data to be queried D Q is the set of all clustering data to be queried, and E(·) represents the mathematical expectation of the internal data.

[0091] Due to D A It is public, and User trains D based on the labeled agent held by Agent (A) A Specific data, calculate the expected value E(x|(x,v)∈D for all data under each label A ).

[0092] Example: Calculate E(x|(x,1)∈D A ),

[0093] Among them, v represents the label, v∈[1,L], the value of L is 6, n A =10.

[0094]

[0095]

[0096] According to the obtained E(x|(x,v)∈D A) can find out each data to be checked The Euclidean distance of each label is used to form a new vector, which is then normalized by softmax to obtain a vector that can represent the probability distribution.

[0097] User will find the estimated vector of the jth query data as Sent to Agent(A).

[0098] Step 104: The querying party sends the data to be queried after homomorphic encryption to the first central agent, which then sends it to all data holders and edge parties of the weak model; each data holder learns the encrypted data to be queried based on the weak model trained with local data, obtains the weak learning results corresponding to the data to be queried under the ciphertext, and sends them to the first central server; the first central server and the second central server obtain the initialization of the aggregation result based on the weight matrix and the weak learning results corresponding to the data to be queried under the ciphertext through the interaction of the two central agents.

[0099]

[0100] Among them, [Prob Q ] The data to be queried needs to be trained by the neural network model to obtain weak learning results, so the User needs to Q Encrypted by homomorphic encryption Q ] is sent to all DOs, and each data holder learns through the neural network to obtain the weak learning result [Prob Q ], DOs will [Prob Q ] is sent to Agent(A). Its [Prob Q ] basic calculation process and Prob A Similar, such as Figure 7 shown.

[0101] According to the characteristics of the softmax function, it is unrealistic to implement such calculations in a dense state because it contains exponential operations. In order to solve this problem, a dual-center agent interaction method is designed to calculate the exponential calculation in a dense state, and then the interaction method is used to implement The calculation of is a dense form, denoted by

[0102] Take [Prob Q] is described by a piece of data, which is recorded as [PROB], that is, for the weak learning result corresponding to the query data under a certain ciphertext, it is multiplied by the weight matrix [PROB]·W=([M1],[M2],...,[M L ]), and get the first product ciphertext [M i ], where [M i ] are all ciphertext, i∈[1,L], L is the number of tag types. The specific interaction process is as follows Figure 4 As shown:

[0103] Agent (A) randomly generates a random value k and holds the public key and the product ciphertext [M i ], based on the random value and the first product ciphertext, obtain the reference value and the second product ciphertext, the second product ciphertext is the product E(M i +k), that is, [M i ]·E(k)=E(M i +k), where E represents encryption (satisfying homomorphic encryption scheme); the reference value is the random value of e to the power of e k .

[0104] Agent(A) will i +k) and e k The first index result and the second index result are sent to Agent (B). Agent (B) holds the public key and the private key. Based on the second product ciphertext and the reference value, the first index result and the second index result are obtained. The first index result and the second index result are encrypted respectively and sent to the first central server. Specifically, Agent (B) uses the private key to encrypt the second product ciphertext E (M i +k) to decrypt, that is, D(E(M i +k))→M i +k, get the decrypted value M i + k, and calculate the decrypted value of e to the power of the first exponent The first index result is divided by the reference value, and then multiplied by the difference between 1 and the reference value to obtain the second index result. Specific:

[0105]

[0106]

[0107] encryption:

[0108]

[0109]

[0110] After the first index result and the second index result are encrypted respectively, and Sent to Agent(A), Agent(A) obtains the ciphertext of the third index result based on the encrypted first index result and second index result

[0111]

[0112] Agent(A) is based on Calculated

[0113] Step 2: Iterative aggregation process from weak results to strong ideal results:

[0114] It is necessary to predict the Dist distribution of each query data. In order to find the ideal Pred, it is assumed that Ω iterations are required. The following is the aggregation process of the τth round:

[0115] Step 201, Agent (A) calculates Dist (τ) :

[0116] In round τ:

[0117] The first central server calculates the estimated vector of each data to be queried in this round based on the aggregation result of the previous round and the estimated vector of each data to be queried. if but

[0118]

[0119]

[0120] Among them, D Q It is an unlabeled data set that the User needs to query; is the jth data to be queried, j∈{1,…,n Q}; α is a hyperparameter used to determine the threshold of whether the prediction is reliable, α∈(0,1); ρ is a probability decay parameter used to replace the estimated probability distribution with a probability weighted to 1.

[0121] Step 202: Agent (A) calculates the weight matrix W of this round based on the weight matrix of the previous round. i τ :

[0122]

[0123] Among them, Z (τ) is the regularization coefficient. After regularization: cori is the spearman rank correlation coefficient, since D Q and Does not satisfy the normal distribution, use the Spearman rank correlation coefficient to reflect Dist (τ) The estimated inference ability of each DOs is The relationship between i The larger the value, the greater the Dist (τ) and The more likely there is a positive correlation.

[0124] Introducing W r :

[0125] To explore W r Updated with more possibilities, to the original W τ Add random perturbation to generate W r .

[0126] Evaluation W τ and W r Pros and Cons:

[0127] Agent (A) first starts from D A Extract a Dist (τ) The subset D′,D′ with the same distribution has the same distribution as Dist and is obtained through Q W To evaluate the performance of W:

[0128]

[0129] The number of D′ is constrained by C, and C satisfies the following formula:

[0130]

[0131] Step 203: Calculate [Pred D(τ) ]:

[0132]

[0133] Among them, τ∈[1,Ω]; [Pred Q(τ-1) ] is the result of the previous round of calculation, and we get The subsequent softmax calculation is still performed using the dual-server interaction method. Finally, after Ω rounds of iterative calculations, the ideal ciphertext can be aggregated.

[0134] The implementation of this step still requires the softmax function. The calculation of the exponent requires the interaction of two central agents. The final softmax calculation of the formula is calculated by Agent (A), but the exponential value needs to be calculated by Agent (B). The specific process is the same as Pred 0 The interaction principle during initialization is the same.

[0135] Step 3, Agent (A) will [Pred Q(Ω) ]Sent to User.

[0136] Step 4: User decryption [Pred Q(Ω) ], and calculate atgmax(Pred Q(Ω) ) to get the result.

[0137] The present invention combines the weak-to-strong result aggregation method with cryptographic privacy protection technology to realize cluster query of privacy-preserving federated learning. During the entire cluster application process, application participants and edge institutions will not leak data privacy. It can achieve ideal cluster query results without the need to jointly train an ideal machine learning model, and will not leak customer data to be queried, thereby ensuring the privacy and security of customer data.

[0138] Embodiment 2

[0139] This embodiment provides a privacy protection clustering system;

[0140] A privacy protection clustering system includes: a querying party, a first central server, a second central server, and a plurality of data holders (edge ​​organizations);

[0141] The querying party is used to obtain the data to be queried, homomorphically encrypt the data to be queried, obtain the encrypted data to be queried, obtain the training set held by the first central server agent, initialize the estimated vector of the data to be queried, and send it to the first central server;

[0142] The data holder is used to learn the encrypted data to be queried based on the weak model trained by the local data, obtain the weak learning result corresponding to the data to be queried under the ciphertext, and send it to the first central server;

[0143] The first central server is used to initialize the weight matrix, and based on the weight matrix and the weak learning result corresponding to the data to be queried under the ciphertext, the second central server interacts with the second central server through a dual-center proxy to obtain an initialized aggregation result, and iteratively updates the aggregation result in combination with the estimated vector of the data to be queried, and sends the updated aggregation result to the query party;

[0144] The query side is also used to decrypt the aggregation results and calculate the clustering query results.

[0145] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A privacy-preserving clustering method, characterized in that: The steps include: The querying party obtains the data to be queried, performs homomorphic encryption on the data to be queried, obtains the encrypted data to be queried, obtains the training set held by the first central server agent, initializes the estimated vector of the data to be queried, and sends it to the first central server; Each data holder learns the encrypted data to be queried based on the weak model trained by the local data, obtains the weak learning result corresponding to the data to be queried under the ciphertext, and sends it to the first central server; The first central server initializes the weight matrix, and based on the weight matrix and the weak learning result corresponding to the data to be queried under the ciphertext, cooperates with the second central server through dual-center proxy interaction to obtain an initialized aggregation result, and iteratively updates the aggregation result in combination with the estimated vector of the data to be queried, and sends the updated aggregation result to the querying party; After the querying party decrypts the aggregation result, it calculates and obtains the clustering query result; The specific method of initializing the estimated vector of the data to be queried is: based on the training set held by the first central server agent, calculating the expected value of all data under each label; calculating the Euclidean distance between the data to be queried and the expected value of all data under each label, and obtaining the initialized estimated vector of the data to be queried after normalization; The specific method for iteratively updating the aggregation results is as follows: in a certain round, the first central server calculates the estimated vector of the data to be queried in this round based on the aggregation results of the previous round and the estimated vector of the data to be queried, and calculates the weight matrix of this round in combination with the weight matrix of the previous round; The first central server and the second central server obtain the aggregation result of this round through dual-center proxy interaction based on the weak learning result corresponding to the to-be-queried data under the ciphertext, the aggregation result of the previous round and the weight matrix of this round; The specific steps of the dual-center proxy interaction are: the first central server multiplies the weak learning result corresponding to the to-be-queried data under a certain ciphertext by the weight matrix to obtain a first product ciphertext, and randomly generates a random value, obtains a reference value and a second product ciphertext based on the random value and the first product ciphertext, and sends them to the second central server; The second central server obtains the first index result and the second index result based on the second product ciphertext and the reference value, encrypts the first index result and the second index result respectively, and sends them to the first central server; The first central server obtains a ciphertext of a third index result based on the encrypted first index result and the second index result, and calculates an initialization aggregation result based on the ciphertext of the third index result.

2. A privacy-preserving clustering method as claimed in claim 1, characterized in that: The calculation method of the weight matrix is: The first central server removes the labels of the training set held by the first central server agent and sends it to all data holders; Each data holder obtains a weak learning result corresponding to the training set held by the first central server agent based on the training set held by the first central server agent after de-labeling, and sends it to the first central server; The first central server calculates the weight matrix based on the weak learning results corresponding to the training set held by the first central server agent.

3. A privacy-preserving clustering method as claimed in claim 1, characterized in that: The second product ciphertext is the product of the ciphertext of the random number k and the first product ciphertext; the reference value is e raised to the power of the random value.

4. A privacy-preserving clustering method as claimed in claim 3, characterized in that: The reference value is a random value raised to the power of e.

5. A privacy-preserving clustering method as claimed in claim 3, characterized in that: The method for calculating the first exponential result is: using a private key to decrypt the second product ciphertext to obtain a decrypted value, and calculating the decrypted value power of e to obtain a first exponential result.

6. A privacy-preserving clustering method as claimed in claim 3, characterized in that: The second index result is calculated by dividing the first index result by the reference value, and then multiplying the result by the difference between 1 and the reference value to obtain the second index result.

7. A privacy-preserving clustering system, characterized in that: It includes a querying party, a first central server, a second central server and several data holders; The querying party is used to obtain the data to be queried, homomorphically encrypt the data to be queried, obtain the encrypted data to be queried, obtain the training set held by the first central server agent, initialize the estimated vector of the data to be queried, and send it to the first central server; The data holder is used to learn the encrypted data to be queried based on the weak model trained by the local data, obtain the weak learning result corresponding to the data to be queried under the ciphertext, and send it to the first central server; The first central server is used to initialize the weight matrix, and based on the weight matrix and the weak learning results corresponding to the data to be queried under the ciphertext, the first central server cooperates with the second central server through dual-center proxy interaction to obtain an initialized aggregation result, and iteratively updates the aggregation result in combination with the estimated vector of each data to be queried, and sends the updated aggregation result to the query party; The querying party is also used to decrypt the aggregation result and calculate the clustering query result; The specific method of initializing the estimated vector of the data to be queried is: based on the training set held by the first central server agent, calculating the expected value of all data under each label; calculating the Euclidean distance between the data to be queried and the expected value of all data under each label, and obtaining the initialized estimated vector of the data to be queried after normalization; The specific method for iteratively updating the aggregation results is as follows: in a certain round, the first central server calculates the estimated vector of the data to be queried in this round based on the aggregation results of the previous round and the estimated vector of the data to be queried, and calculates the weight matrix of this round in combination with the weight matrix of the previous round; The first central server and the second central server obtain the aggregation result of this round through dual-center proxy interaction based on the weak learning result corresponding to the to-be-queried data under the ciphertext, the aggregation result of the previous round and the weight matrix of this round; The specific steps of the dual-center proxy interaction are: the first central server multiplies the weak learning result corresponding to the to-be-queried data under a certain ciphertext by the weight matrix to obtain a first product ciphertext, and randomly generates a random value, obtains a reference value and a second product ciphertext based on the random value and the first product ciphertext, and sends them to the second central server; The second central server obtains the first index result and the second index result based on the second product ciphertext and the reference value, encrypts the first index result and the second index result respectively, and sends them to the first central server; The first central server obtains a ciphertext of a third index result based on the encrypted first index result and the second index result, and calculates an initialization aggregation result based on the ciphertext of the third index result.

Images